AWS EC2 Instance: Web App successfully deployed but remains unreachable on the browser

Question

I have a MERN app and I have successfully deployed it on an AWS EC2 instance. In the production environment, the app is served on port 80.
So when I try to access it on the browser by entering:

EC2_INSTANCE_PUBLIC_IP_ADDRESS:80

or

EC2_INSTANCE_PUBLIC_IP_ADDRESS

It just keeps loading until it finally reaches this state:

This site can’t be reached EC2_INSTANCE_PUBLIC_IP_ADDRESS took too long to respond.

Try:

Checking the connection Checking the proxy and the firewall ERR_CONNECTION_TIMED_OUT

I tried to run the frontend app separately as I do in the development environment on port 3000, so when I try to access it on

EC2_INSTANCE_PUBLIC_IP_ADDRESS:3000

The same thing happens.
Any idea what's going on?

Answer 1

Check the security group associated with the EC2 instance. The security group can be seen as the firewall configuration associated with the EC2 instance.

Your security group will need to have an inbound rule defined for port 80 (or 3000 as per your question and\or active configuration). You don't need to have an outbound rule:

Security groups are stateful - if you send a request from your instance, the response traffic for that request is allowed to flow in regardless of inbound security group rules. Responses to allowed inbound traffic are allowed to flow out, regardless of outbound rules.

I'll check the security group first. If it still doesn't work then there might be a problem with the reachability of the EC2 instance's subnet from the internet. For example, it might not be connected to an internet gateway.

More advanced:

There are other ways besides an internet gateway to connect your subnet to the internet, eg NAT gateways and VPN connections. Yet it seems that you are comfortable connecting to your work using a public IP, just make sure you configure your security group with a restrictive inbound rule specific to your personal IP address followed by a /32 CIDR (play around with the security group GUI, as I recall AWS can auto-populate your IP for you and then you'll see that it has a /32 suffix)

Additional notes:

You don't need a outbound rule for your security group to connect to the EC2 instance across the internet, but you might want to specify a very lax outbound rule so that you can connect to the EC2 instance and retrieve things from the internet. Without an outbound rule you won't even be able to retrieve packages you might want to install (eg yum install -y some_package)